Описание
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
Ссылки
- Patch
- Patch
- Vendor Advisory
- Patch
- Patch
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.3.3 (исключая)
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*
EPSS
Процентиль: 0%
0.00003
Низкий
6.5 Medium
CVSS3
9.1 Critical
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 6.5
github
почти 2 года назад
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
EPSS
Процентиль: 0%
0.00003
Низкий
6.5 Medium
CVSS3
9.1 Critical
CVSS3
Дефекты
CWE-862